capstone-d

What is this?

This package implements idiomatic D bindings for version 4.0 of Capstone - the disassembly framework powering many reverse engineering tools. If you do not need the expressivity and safety of D but just the plain C API in D, non-idiomatic bindings might be just what you're looking for.

Examples

Introductory Example

The following D code uses these bindings for a concise implementation of the introductory example for the original C library.

How to include this in your project

The package is available in the D package management s.t. it suffices to add capstone-d as a dependency in the dub.json of your project.
Furthermore, the examples folder contains a basic project to get you started.

F.A.Q.

The C API had cs_op_count to count an instruction's number of operands of a givenType. Why is it missing?

Because this can easily be accomplished in D as follows:

auto number = operands.count!(op => op.type == givenType)

In the C API, if you want to iterate over an instruction's operands of a given type, you first have to determine those operands' indices in the operands array. To this end the C API provides cs_op_index to determine the index of an instruction's k-th operand of a givenType in the operands array. Why is this function missing in these bindings?

Because in D, accessing operands of a given type is easier than using such a function:

auto opsOfGivenType = operands.filter!(op => op.type == givenType)

How to determine an instruction's length in bytes ?

Unlike in the C API, an instruction instr does indeed not have a size member. In D, arrays & slices have length, so you can simpliy use instr.bytes.length.

Contribute

If you find bugs or think that something could be improved, simply create an according issue.
If you want to tackle an issue or contribute to the plugin feel free to create a pull request.